lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: pass 'nf_hook_ops' instead of 'list_head' to nf_iterate()

Browse Source 
Since 'list_for_each_continue_rcu' has already been replaced by
'list_for_each_entry_continue_rcu', pass 'list_head' to nf_iterate() as a
parameter can not benefit us any more.

This patch will replace 'list_head' with 'nf_hook_ops' as the parameter of
nf_iterate() to save code.

Signed-off-by: Michael Wang <wangyun@linux.vnet.ibm.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Michael Wang
2012-08-22 19:59:57 +00:00
committed by Pablo Neira Ayuso
parent 965505015b
commit 2a6decfd8a
3 changed files with 14 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
net/netfilter/core.c
View File

@@ -126,42 +126,38 @@ unsigned int nf_iterate(struct list_head *head,
unsigned int hook, unsigned int hook,
const struct net_device *indev, const struct net_device *indev,
const struct net_device *outdev, const struct net_device *outdev,
struct list_head **i, struct nf_hook_ops **elemp,
int (*okfn)(struct sk_buff *), int (*okfn)(struct sk_buff *),
int hook_thresh) int hook_thresh)
{ {
unsigned int verdict; unsigned int verdict;
struct nf_hook_ops *elem = list_entry_rcu(*i, struct nf_hook_ops, list);
/* /*
* The caller must not block between calls to this * The caller must not block between calls to this
* function because of risk of continuing from deleted element. * function because of risk of continuing from deleted element.
*/ */
list_for_each_entry_continue_rcu(elem, head, list) { list_for_each_entry_continue_rcu((*elemp), head, list) {
if (hook_thresh > elem->priority) if (hook_thresh > (*elemp)->priority)
continue; continue;
/* Optimization: we don't need to hold module /* Optimization: we don't need to hold module
reference here, since function can't sleep. --RR */ reference here, since function can't sleep. --RR */
repeat: repeat:
verdict = elem->hook(hook, skb, indev, outdev, okfn); verdict = (*elemp)->hook(hook, skb, indev, outdev, okfn);
if (verdict != NF_ACCEPT) { if (verdict != NF_ACCEPT) {
#ifdef CONFIG_NETFILTER_DEBUG #ifdef CONFIG_NETFILTER_DEBUG
if (unlikely((verdict & NF_VERDICT_MASK) if (unlikely((verdict & NF_VERDICT_MASK)
> NF_MAX_VERDICT)) { > NF_MAX_VERDICT)) {
NFDEBUG("Evil return from %p(%u).\n", NFDEBUG("Evil return from %p(%u).\n",
elem->hook, hook); (*elemp)->hook, hook);
continue; continue;
} }
#endif #endif
if (verdict != NF_REPEAT) { if (verdict != NF_REPEAT)
*i = &elem->list;
return verdict; return verdict;
}
goto repeat; goto repeat;
} }
} }
*i = &elem->list;
return NF_ACCEPT; return NF_ACCEPT;
} }
@@ -174,14 +170,14 @@ int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
int (*okfn)(struct sk_buff *), int (*okfn)(struct sk_buff *),
int hook_thresh) int hook_thresh)
{ {
struct list_head *elem; struct nf_hook_ops *elem;
unsigned int verdict; unsigned int verdict;
int ret = 0; int ret = 0;
/* We may already have this, but read-locks nest anyway */ /* We may already have this, but read-locks nest anyway */
rcu_read_lock(); rcu_read_lock();
elem = &nf_hooks[pf][hook]; elem = list_entry_rcu(&nf_hooks[pf][hook], struct nf_hook_ops, list);
next_hook: next_hook:
verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev, verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev,
outdev, &elem, okfn, hook_thresh); outdev, &elem, okfn, hook_thresh);
@@ -193,8 +189,8 @@ next_hook:
if (ret == 0) if (ret == 0)
ret = -EPERM; ret = -EPERM;
} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
int err = nf_queue(skb, elem, pf, hook, indev, outdev, okfn, int err = nf_queue(skb, &elem->list, pf, hook, indev, outdev,
verdict >> NF_VERDICT_QBITS); okfn, verdict >> NF_VERDICT_QBITS);
if (err < 0) { if (err < 0) {
if (err == -ECANCELED) if (err == -ECANCELED)
goto next_hook; goto next_hook;

2
net/netfilter/nf_internals.h
View File

@@ -18,7 +18,7 @@ extern unsigned int nf_iterate(struct list_head *head,
unsigned int hook, unsigned int hook,
const struct net_device *indev, const struct net_device *indev,
const struct net_device *outdev, const struct net_device *outdev,
struct list_head **i, struct nf_hook_ops **elemp,
int (*okfn)(struct sk_buff *), int (*okfn)(struct sk_buff *),
int hook_thresh); int hook_thresh);

6
net/netfilter/nf_queue.c
View File

@@ -287,7 +287,7 @@ int nf_queue(struct sk_buff *skb,
void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
{ {
struct sk_buff *skb = entry->skb; struct sk_buff *skb = entry->skb;
struct list_head *elem = &entry->elem->list; struct nf_hook_ops *elem = entry->elem;
const struct nf_afinfo *afinfo; const struct nf_afinfo *afinfo;
int err; int err;
@@ -297,7 +297,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
/* Continue traversal iff userspace said ok... */ /* Continue traversal iff userspace said ok... */
if (verdict == NF_REPEAT) { if (verdict == NF_REPEAT) {
elem = elem->prev; elem = list_entry(elem->list.prev, struct nf_hook_ops, list);
verdict = NF_ACCEPT; verdict = NF_ACCEPT;
} }
@@ -323,7 +323,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
local_bh_enable(); local_bh_enable();
break; break;
case NF_QUEUE: case NF_QUEUE:
err = __nf_queue(skb, elem, entry->pf, entry->hook, err = __nf_queue(skb, &elem->list, entry->pf, entry->hook,
entry->indev, entry->outdev, entry->okfn, entry->indev, entry->outdev, entry->okfn,
verdict >> NF_VERDICT_QBITS); verdict >> NF_VERDICT_QBITS);
if (err < 0) { if (err < 0) {